Posted by Wilfred Spiegelenburg on Oct 07 Severity: CVSS 4.0: 2.0 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected versions: - Apache YuniKorn before 1.10.0 Description: Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets",...
CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/84
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing…
Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459)
Posted by Nebojša Jaćović on Oct 12 Hi, I'm disclosing a vulnerability in kubernetes/cloud-provider-gcp that I reported to Google Cloud VRP on 2026-06-14 (Issue…
CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
Posted by Andrea Cosentino on Oct 09 Severity: CVSS 3.1: 8.8 (high) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected versions: - Apache Camel Karavan 4.0.0 before…
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
Posted by Wenjun Ruan on Oct 07 Severity: important Affected versions: - Apache DolphinScheduler 3.1.0 before 3.4.3 Description: An authorization vulnerability in Apache…
Node.js security release pre-alert
Posted by Antoine du Hamel on Nov 04 We will release new versions of Node.js 22, 24, and 26 release lines on or shortly after 2026-11-11 in order to address security…